Skip to content

Harden gateway file access and launch artifacts - #18

Closed
codepilotios wants to merge 11 commits into
mainfrom
agent/security-scan
Closed

codepilotios wants to merge 11 commits into
mainfrom
agent/security-scan

Conversation

@codepilotios

Copy link
Copy Markdown
Owner

Summary

  • block gateway file downloads from CodePilot and Codex state directories
  • enforce private permissions on gateway tokens, uploaded attachments, launch plists, and Cloudflare setup artifacts
  • add gateway regression tests for protected paths and upload permissions

Verification

  • scripts/privacy-audit.sh
  • env PYTHONPATH=/tmp/codex-security-preflight-py39:gateway python3 -m unittest gateway.test_codex_phone_gateway gateway.test_remote_desktop_gateway
  • zsh -n scripts/install-phone-gateway-agent.sh
  • zsh -n scripts/setup-cloudflare-remote-access.sh

@codepilotios
codepilotios force-pushed the agent/security-scan branch 2 times, most recently from 854288a to 342f099 Compare July 19, 2026 02:27
@codepilotios
codepilotios force-pushed the agent/security-scan branch from 083accb to e383e66 Compare July 19, 2026 02:38
@codepilotios

Copy link
Copy Markdown
Owner Author

Closing as superseded by #22, which merged the security hardening with passing CI. After rebasing this older branch onto current main it reintroduced gateway/iOS regressions, so it should not be merged separately.

@codepilotios
codepilotios deleted the agent/security-scan branch July 19, 2026 02:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant